A recognisable photograph of a person can be their personal data, so UK GDPR is engaged in principle. But the law contains specific exemptions for personal or household use, and for journalistic, artistic and literary purposes — and ordinary street photography falls squarely within them.

In plain terms: shooting candid photographs of people in public as personal, artistic or editorial work is not a data protection breach, does not require consent, and does not require you to hand anything over on demand. The rules bite mainly at the commercial and publishing edges, and around behaving reasonably — not on the act of taking the picture.

Potentially, yes. Personal data is information relating to an identifiable living person, and an image in which someone is recognisable can qualify. In some cases it can even be special category data — for example, a photograph that reveals someone's ethnicity, religion (say, clothing) or health.

That sounds alarming, but being personal data is only the starting point. Everything then depends on the purpose you are processing it for, because that purpose determines which exemptions apply. And for street photography, the relevant exemptions are wide.

Personal or household use. UK GDPR does not apply to processing carried out by an individual purely for personal or household activity. Photography as a hobby — taking pictures, keeping them, printing them for yourself, showing friends — generally falls here. This exemption alone covers a large share of what amateur street photographers do.

Journalistic, artistic and literary purposes. The Data Protection Act 2018 provides a broad exemption (often called the 'special purposes' exemption) for processing carried out with a view to publication of journalistic, artistic or literary material, where publication would be in the public interest and complying with the standard rules would be incompatible with those purposes. Street photography is a recognised documentary and artistic practice, and exhibiting, publishing or selling it as art or editorial work generally sits within this exemption.

Between these two, the ordinary business of street photography — shooting candidly in public, keeping an archive, exhibiting, publishing to a photography audience, selling prints as art — is covered. Consent is not the basis you are relying on, which is why you do not need to ask.

The exemptions are broad but not infinite. Data protection is more likely to matter when:

You use images commercially to identify or endorse. Using a recognisable person's image to advertise a product or service moves you away from the artistic and journalistic purposes and towards processing that needs a proper lawful basis — and also engages image-rights and advertising rules. This is the single most common way a street photograph creates real exposure.

You process at scale or systematically. A one-off candid is very different from, say, running automated facial recognition across your archive, or building a searchable database of identified individuals. Systematic, large-scale or biometric processing is exactly what the law is concerned with.

You publish something harmful. Captioning that defames or distresses, or publishing an image that intrudes on a genuine reasonable expectation of privacy (a medical moment, a person in real vulnerability), can create liability that the taking of the photo did not.

For the everyday street photographer, none of these describe normal practice — but they are the lines worth knowing.

Occasionally someone asserts a 'right to be forgotten' or asks for everything you hold on them. Two things are worth understanding.

First, the rights people invoke — access, erasure, objection — apply to a data controller processing their data under the standard rules. Where your processing is covered by the personal-use or special-purposes exemptions, those rights are limited or disapplied accordingly. A stranger cannot simply compel an artist to delete a frame by citing GDPR, any more than they can compel deletion on the street (see what to say when someone asks you to delete a photo).

Second, this is about legal obligation, not about what is kind. You are often free to delete a photograph if someone is genuinely upset, and sometimes that is the right call. Keeping the option in your own hands — rather than believing you are legally forced either way — is the whole point.

Shoot candidly in public for personal, artistic or editorial purposes and you are within the law. You do not need consent, you do not need a model release for artistic or editorial use, and you are not obliged to delete on demand.

Be deliberate the moment money and identification meet — using a recognisable stranger to sell something is the real risk zone, so get advice or a release before any commercial use. Do not build systematic databases of identified people or run biometric processing over your archive. And let ethics, not just law, guide the edge cases: the exemptions permit a great deal that a thoughtful photographer might still choose not to publish.